Magic Eden legacy approvals leave $5.7 million in NFTs exposed to exploit before rescue

Magic Eden said on Friday that its legacy approvals on its EVM marketplace left NFTs worth more than $5.7 million exposed to an exploit in Limit Break’s Payment Processor V2.

In an X post, the NFT marketplace said it stopped using the processor in October 2024 and shut down its EVM marketplace in the first quarter of 2026. "No live Magic Eden listings were impacted," it wrote.

The vulnerability surfaced after an attacker exploited the processor to steal 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives, according to Yuga Labs Vice President of Blockchain 0xQuit.

0xQuit said Limit Break quickly paused Payment Processor V3, which was affected by the same bug, but V2 could not be paused.

That left a whitehat operation as the main way to protect assets, the VP said, adding that the operation rescued 23,155 NFTs worth more than $5.7 million.

However, the rescue did not cover 660 WETH that was also vulnerable to a related exploit.

"We later discovered that a similar exploit could be used in reverse to steal WETH," 0xQuit wrote in an X post. "660 WETH was at risk, which we unfortunately were not fast enough to recover."

According to Magic Eden's update, NFTs listed on its EVM marketplace between roughly February and October 2024 may be affected. The platform advised users to revoke the Payment Processor V2 approval on Ethereum, Polygon, and Base.

Meanwhile, users will be able to reclaim rescued NFTs after revoking the exploitable approvals.